Developer guide

Android enterprise provides organizations with a secure, flexible, and
unified Android mobility platform—combining devices, applications,
and management. Android apps are compatible with Android enterprise
by default. However, there are additional features you can use to make
your app work best on managed Android devices:

Note: Android's enterprise features function natively on most
Android 5.0 devices; however, Android 6.0 and later offers
additional features, especially with regard to COSU.

Manage profiles

You can manage a user’s business data and applications through a
work profile. A work profile is a managed corporate profile
associated with the primary user account on an Android device. A
work profile securely isolates work apps and data from personal apps
and data. This work profile is in a separate container from the
personal profile, which your user controls. These separate profiles
allow organizations to manage the business data they care about, but
leave everything else on a user’s device under the user’s control.
For a deep dive into best practices, see the
Set up Managed Profiles
guide. For an overview of those best practices, see below.

Key features of a managed profile

Separate and secure profile

Managed Google Play for application distribution

Separate badged work applications

Profile-only management capabilities controlled by an administrator

Managed profile benefits on Android 5.0+

Full device encryption

One Android application package (APK) for both profiles when
there’s a personal profile and a work profile present on the device

Considerations for managed profiles

A file path (Uniform Resource Identifier [URI]) that’s valid on
one profile may not be valid on the other.

Prevent intents from failing between profiles

It’s difficult to know which intents can cross between profiles, and
which ones are blocked. The only way to know for sure is by testing.
Before your app starts an activity, you should verify that the
request is resolved by calling
Intent.resolveActivity().

If it returns null, the request doesn’t resolve.

If it returns something, it shows that the intent resolves,
and it’s safe to send the intent.

Share and grant permissions to access the content URI using
an Intent. Permissions can only be passed across the profile
boundary using Intents. If you grant another app access rights
to your file using
Context.grantUriPermission(), it only is granted for
that app in the same profile.

Don't use:
File URI

Contains the absolute path of the file on the device’s
storage.

A file path URI that’s valid on one profile isn’t valid on
the other.

If you attach a file URI to an intent, a handler is unable
to access the file in another profile.

Implement managed configurations

Managed configurations are a set of instructions that IT administrators
can use to manage their users’ mobile devices in a specific way.
These instructions are universal and work across any EMM, allowing
administrators to remotely configure applications on their users’
phones.

If you’re developing apps for business or government, you may need
to satisfy your industry’s specific set of requirements. Using
managed configurations, the IT administrator can remotely specify
settings and enforce policies for their users’ Android apps; for
example:

Configure if an app can sync data via cellular/3G, or only Wi-Fi

Whitelist or blacklist URLs on a web browser

Configure an app's email settings

Enable or disable printing

Manage bookmarks

Best practices for implementing managed configurations

The Set up Managed Configurations
guide is the key source for information on how to build and deploy
managed configurations. After you’ve reviewed this documentation, see
recommendations below for additional guidance.

When first launching the app

As soon as you launch an application, you can see if managed
configurations are already set for this app in onStart() or
onResume(). Additionally, you can find out if your
application is managed or unmanaged. For example, if
getApplicationRestrictions() returns:

A set of application-specific restrictions—You
can configure the managed configurations silently (without requiring
user input).

An empty bundle—Your application acts like
it’s unmanaged (for example, how the app behaves in a personal
profile).

A bundle with a single key value pair with
KEY_RESTRICTIONS_PENDING set to true—your
application is being managed, but the DPC isn’t configured
correctly. You should block this user from your app, and direct
them to their IT administrator.

Listen for changes to managed configurations

IT administrators can change managed configurations and what
policies they want to enforce on their users at any time. Because of
this, we recommend you ensure that your app can accept new
restrictions for your managed configuration as follows:

Fetch restrictions on launch—Your app should
call getApplicationRestrictions() in onStart()
and onResume(), and compare against old restrictions
to see if changes are required.

Listen while running—Dynamically register
ACTION_APPLICATION_RESTRICTIONS_CHANGED in your
running activities or services, after you’ve checked for new
restrictions. This intent is sent only to listeners that are
dynamically registered, and not to listeners declared in the app
manifest.

Unregister while not running—In onPause(),
you should unregister for the broadcast of
ACTION_APPLICATION_RESTRICTIONS_CHANGED.

COSU devices

Corporate-owned, single-use devices (COSU) are kiosk devices used
for a single purpose, such as digital signage displays, ticket
printing kiosks, or checkout registers.

When an Android device is configured as a COSU device, the user sees
an application locked to the screen with no Home or Recent Apps
buttons to escape the app. COSU can also be configured to show a set
of applications, such as a library kiosk with an app for the library
catalog and a web browser.

Set up single sign-on with Chrome custom tabs

Enterprise users often have multiple apps on their device, and they
prefer to sign in once to access all of their work applications.
Typically, users sign in through a
WebView;
however, there are a couple reasons why this isn’t ideal:

Users often need to sign in multiple times with the same
credentials. The WebView solution often isn’t a true Single
Sign-On (SSO) experience.

There can be security risks, including malicious applications
inspecting cookies or injecting JavaScript® to access a user’s
credentials. Even trusted developers are at risk if they rely on
potentially malicious third-party SDKs.

A solution to both problems is to authenticate users using browser
Custom Tabs, instead of WebView. This ensures that authentication:

Occurs in a secure context (the system browser) where the host app
cannot inspect contents.

Has a shared cookie state, ensuring the user has to sign in only
once.

Requirements

Custom Tabs are supported back to API level 15 (Android 4.0.3).
To use Custom Tabs you need a supported browser, such as Chrome.
Chrome 45 and later implement this feature as
Chrome Custom Tabs.

How do I implement SSO with custom tabs?

Google has open sourced an OAuth client library that uses Custom
Tabs, contributing it to the OpenID Connect working group of the
OpenID Foundation. To set up Custom Tabs for SSO with the
AppAuth library, see the documentation and sample code on GitHub, or try
the codelab.

Test your app with Android in the enterprise

Once you’ve developed your app, you’ll want to test it in a work
profile—both as a profile owner and device owner. See the
instructions below.

Use TestDPC to test your Android app

TestDPC is a tool you can use to test your Android app in a variety
of enterprise environments. You can configure it as a profile
owner or a device owner to launch management APIs on your device,
using one of these methods:

For more information on how to configure TestDPC, see the
instructions below and the
TestDPC User Guide.

REQUIRED: Your test Android device needs to run
Android 5.0 or later and be able to natively support Android enterprise.

Provision a profile owner

To test your app in a work profile, you need to first provision a
profile owner on the TestDPC app:

Launch the TestDPC app and click Set up profile.

When prompted, click Set up, ensuring the
TestDPC’s logo is highlighted on the screen.

If your device isn’t encrypted, you need to encrypt your device.
Follow the briefcase notification after reboot to continue
provisioning.
Once you’ve provisioned the profile owner correctly, badged
applications appear at the end of your app tray. Install your app
on the device and test to see how it runs in the work profile.

Install your app on the device and test to see how it runs in the
work profile.

Caution: When running your app with Instant Run in
Android Studio, attempting to open your app with a work profile or secondary
profile will crash your app. To use your app with the work profile, we
recommend you create a new run
configuration that includes the --user user_id flag,
specifying the work profile user ID. You can find the user ID by executing
adb shell pm list users from command line. For more information,
see the Instant Run
documentation.

Provision a device owner

Testing your app as a device owner requires more steps than testing
as a profile owner. You first need to provision the device owner on
your test device using the
NfcProvisioning sample
app. For complete instructions to provision TestDPC in device owner mode using the
NfcProvisioning app, see the TestDPC User Guide.

Download the NfcProvisioning app
sample files to your development environment.

Unpack the project, open your shell, and cd to the project directory.

Add a file to the directory with the local.properties name
and the following content:

sdk.dir=/path/to/your/android/sdk

While in the project directory, enter these commands to build the NfcProvisioning APK:

./gradlew init
./gradlew build

The NfcProvisioning APK you need is now located in ./Application/build/outputs/apk.

Install the APK on your programmer device, which you can use to provision other devices.

Create a text file called nfcprovisioning.txt and
include the following information:

Open the NFC Provisioning app and ensure com.google.android.testdpc
is auto-populated.

Bump the devices to transfer the data.

Follow the onscreen instructions to set up your target device.

Once you’ve completed provisioning the device owner, you can test your app on that device. You
should specifically test how
managed configurations,
URIs, and
intents
work on that device.

End-to-end testing

After you’ve finished testing your app in the environments above,
you’ll likely want to test your app in an end-to-end production
environment. This process includes the steps a customer needs to
take to deploy your app in their organization, including:

App distribution through Play

Server-side managed configuration

Server-side profile policy control

You need to access an EMM console to complete the end-to-end
testing. The easiest way to get one is to request a testing console
from your EMM. Once you have access, complete these tasks:

Claim a managed Google domain and bind it to your EMM. If you
already have a testing domain that’s bound to an EMM, you may need
to unbind it to test it with your preferred EMM. Please consult your
EMM for the specific unbinding steps.

This process will differ based on your EMM. Please consult your
EMM’s documentation for further details. Congrats! You’ve completed
these steps and verified that your app works well with Android in the enterprise.